APP Pentest & Teardown Analyzer
Paste the following prompt into your AI chat to install this skill:
Please install @user_912fbf9a/app-pentest-analyzer according to https://skillhub.cn/install/skillhub.md.
About this skill
Problem
Manual app teardown often scatters artifacts: decompiled trees, proxy logs, SDK lists, and DNS traces are hard to connect. It is easy to miss which so file belongs to which vendor, where a CNAME chain resolves in cloud infrastructure, or whether dynamic testing crosses the authorization boundary. This skill turns competitive teardown, security audit, and SDK supply-chain review into a fixed workflow with inspectable artifacts at each step.
How it works
The workflow has six stages. It starts by confirming package type, platform, test account, business domain, and authorization limits. Static unpacking uses apktool, jadx, aapt2, otool, and related tools to generate manifest_summary.json, string dumps, and decompiled output. SDK detection matches package paths, so names, and resource fingerprints to vendor and capability. Domain extraction is followed by DNS and ASN/Org mapping to identify cloud providers such as Tencent Cloud, AWS, or Cloudflare. Security review covers OWASP MASVS/MSTG, hardcoded secrets, exposed components, WebView risk, and SDK compliance. With authorization and an account, it can run sandbox analysis: mitmproxy and Frida capture traffic and hooks, then export HAR, screen recordings, and logs to derive an architecture diagram from request clustering.
Boundaries
This is for authorized analysis only; downloading from an app store is not consent for dynamic testing. Without an account, coverage is limited to static and guest-state checks, and gaps should be disclosed. Reports should exclude real user data and plaintext credentials, and legal compliance conclusions remain with the business owner.
Use Cases
- A security team receives a competitor APK and needs to identify third-party SDKs, extract domains, and map IPs to Tencent Cloud, AWS, or Cloudflare.
- A compliance auditor checks Android permissions, plaintext storage, hardcoded secrets, and exposed components, then produces remediation notes with evidence paths.
- An architect runs authorized dynamic testing, captures main-path HAR files and recordings with `mitmproxy` and `Frida`, and derives client, gateway, service, and SDK relationships.
- A product analysis lead compiles SDK inventory, domain attribution, security findings, and public industry data into a PRM report.
Best For
- Mobile security engineer: needs authorized APK/IPA teardown, SDK fingerprinting, and security checklist review.
- Application compliance auditor: needs permissions, SDK initialization, data collection, and privacy disclosure items organized into an evidence-based report.
- Architect or SRE: needs domains, ASNs, cloud vendors, and request paths connected into architecture inference material.
- Competitive analysis lead: needs PRM benchmark sections based on teardown results and public industry information.
Related Skills
Analyzes network captures from Wireshark, tcpdump, Fiddler, and Charles, then pinpoints TCP, HTTP, DNS, and TLS issues with filter expressions and remediation steps.
Detects AI-generated images from Stable Diffusion, Midjourney, and GPT-4o via Tencent Cloud image moderation and returns risk scores.
Sets up a baseline Dynamo router, enables KV-aware routing when appropriate, and smoke tests the frontend endpoint locally or on Kubernetes.
CTF cryptography quick reference for engineers covering classic, modern, RSA, ECC, stream, PRNG, and lattice attacks.